Feed live

The CMS vulnerability ledger.

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

357,200

All time

Critical · Active

12,821

CVSS ≥ 9.0

New · 14 days

2,434

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-42716	critical	9.8/10	WordPress Payever - WooCommerce Gateway plugin <= 4.8.2 - PHP Object Injection vulnerability	Oct 10, 2026 16d ago
CVE-2026-42704	high	8.1/10	WordPress Kids Care theme <= 3.2.4 - Local File Inclusion vulnerability	Oct 10, 2026 16d ago
CVE-2026-106609	high	7.5/10	WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability	Oct 10, 2026 16d ago
CVE-2026-106608	high	7.2/10	WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Privilege Escalation vulnerability	Oct 10, 2026 16d ago
CVE-2026-105889	critical	9.3/10	WordPress Tickera plugin <= 3.6.0.6 - SQL Injection vulnerability	Oct 10, 2026 16d ago
CVE-2026-104398	critical	9.8/10	WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability	Oct 10, 2026 16d ago
CVE-2026-103357	medium	6.9/10	WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability	Oct 10, 2026 16d ago
CVE-2026-103071	high	7.5/10	WordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.3 - Content Injection vulnerability	Oct 10, 2026 16d ago
CVE-2026-94160	high	7.1/10	WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability	Oct 10, 2026 16d ago
CVE-2026-62044	high	7.2/10	WordPress Super Video Player plugin <= 1.8.13 - PHP Object Injection vulnerability	Oct 10, 2026 16d ago
CVE-2026-97340	medium	6.4/10	Avada \| Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field	Oct 10, 2026 17d ago
CVE-2026-104759	high	8.1/10	WPO365 \| SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 \| LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification	Oct 10, 2026 17d ago
CVE-2026-97396	medium	6.4/10	Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint	Oct 10, 2026 17d ago
CVE-2026-96765	high	7.2/10	WPO365 \| SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 \| LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)	Oct 10, 2026 17d ago
CVE-2026-94062	high	8.1/10	WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability	Oct 9, 2026 17d ago
CVE-2026-62036	medium	4.3/10	WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability	Oct 9, 2026 17d ago
CVE-2026-95598	high	7.1/10	WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability	Oct 9, 2026 18d ago
CVE-2026-95610	high	8.5/10	WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability	Oct 9, 2026 18d ago
CVE-2026-96337	medium	6.5/10	WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability	Oct 9, 2026 18d ago
CVE-2026-27420	medium	6.5/10	WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability	Oct 8, 2026 18d ago
CVE-2026-106611	high	7.1/10	WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability	Oct 8, 2026 18d ago
CVE-2026-103072	medium	4.3/10	WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability	Oct 8, 2026 18d ago
CVE-2026-105888	medium	5.4/10	WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability	Oct 8, 2026 18d ago
CVE-2026-106603	medium	6.5/10	WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability	Oct 8, 2026 18d ago
CVE-2026-82627	high	7.5/10	Uncanny Automator – AI + Automation for WordPress \| AI Agent, AI Page Builder, Free AI Usage Included <= 7.6.1.1 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion	Oct 8, 2026 19d ago
CVE-2026-17538	medium	5.4/10	Appointment Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification	Oct 7, 2026 19d ago
CVE-2026-95606	critical	9.8/10	WordPress The Events Calendar plugin <= 6.17.4 - PHP Object Injection vulnerability	Oct 7, 2026 19d ago
CVE-2026-94662	high	7.1/10	WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability	Oct 7, 2026 19d ago
CVE-2026-42714	high	7.6/10	WordPress Pix por Piggly (para Woocommerce) plugin <= 2.1.2 - SQL Injection vulnerability	Oct 7, 2026 20d ago
CVE-2026-66666	medium	6.9/10	WordPress Core <= 7.1.2 - Unauthenticated Sensitive Data Exposure of Comments on Private and Unpublished Posts via Comment Feed vulnerability	Oct 6, 2026 20d ago